---
id: CVE-2026-119285
aliases:
  - GHSA-g5jq-qmqr-qrwf
title: >-
  Fiber: CORS wildcard origins matched without a dot boundary, allowing
  credentialed cross-origin reads
summary: >-
  Fiber: CORS wildcard origins matched without a dot boundary, allowing
  credentialed cross-origin reads
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N'
vendor: gofiber
product: github.com/gofiber/fiber/v2
ecosystem: go
affected:
  - 'github.com/gofiber/fiber/v2 >= 2.52.1, < 2.52.3'
patched:
  - github.com/gofiber/fiber/v2 2.52.3
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T23:15:05.503098884Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-g5jq-qmqr-qrwf'
references:
  - url: 'https://github.com/gofiber/fiber/security/advisories/GHSA-g5jq-qmqr-qrwf'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-119285'
  - url: 'https://github.com/gofiber/fiber/pull/2915'
  - url: >-
      https://github.com/gofiber/fiber/commit/1aac6f618b6bd3e159d2449acb4232a2170b976b
  - url: 'https://github.com/gofiber/fiber'
  - url: 'https://github.com/gofiber/fiber/releases/tag/v2.52.3'
  - url: 'https://github.com/advisories/GHSA-g5jq-qmqr-qrwf'
tags:
  - osv
  - go
  - ghsa
epss: 0.00129
epssPercentile: 0.02489
cwe:
  - CWE-346
  - CWE-942
ingestedAt: '2026-10-30T23:11:25.784Z'
---

## Overview

### Summary

In v2.52.1 and v2.52.2 the CORS middleware matched a wildcard origin such as `https://*.example.com` by suffix only, without a dot boundary and without comparing the scheme. Any origin whose host ends with the base domain, for example `https://evil-example.com` or `http://notexample.com`, was reflected in `Access-Control-Allow-Origin`, together with `Access-Control-Allow-Credentials: true` when `AllowCredentials` is enabled.

v2.52.3 replaced the matcher (#2915) and is not affected. The report was filed against v2.52.15, where the dot boundary holds; see "Other versions" below.

### Details

v2.52.1 introduced `validateDomain` in `middleware/cors/utils.go` (f0cd3b44, part of the fix for GHSA-fmg4-x8pw-hjhg). It strips scheme and port from both sides and then checks only the suffix, with `trimmedPattern = "example.com"`, so the character before the suffix is never checked:

```go
if strings.HasPrefix(normalizedPattern, "*.") {
	trimmedPattern := normalizedPattern[2:]
	if strings.HasSuffix(normalizedDomain, trimmedPattern) {
		if normalizedDomain != trimmedPattern {
			if strings.TrimSuffix(normalizedDomain, trimmedPattern) != "" {
				return true
			}
		}
	}
}
```

v2.52.3 (1aac6f61, #2915) replaced it with a scheme-aware prefix/suffix split that keeps the leading dot in the suffix (`.example.com`).

### Proof of concept

```go
app := fiber.New()
app.Use(cors.New(cors.Config{
	AllowOrigins:     "https://*.example.com",
	AllowCredentials: true,
}))
app.Get("/", func(c *fiber.Ctx) error { return c.SendString("secret") })
```

Request with `Origin: https://evil-example.com`, as a GET and as a preflight (`OPTIONS` with `Access-Control-Request-Method: GET`):

| Version | `https://evil-example.com` | `http://evil-example.com` |
|---|---|---|
| v2.52.0 | not allowed | not allowed |
| v2.52.1, v2.52.2 | reflected, `Access-Control-Allow-Credentials: true` | reflected, `Access-Control-Allow-Credentials: true` |
| v2.52.3 to v2.52.16 | not allowed | not allowed |

### Impact

An app that configures a wildcard-subdomain `AllowOrigins` with `AllowCredentials: true` lets any page on a domain that ends with the base domain (for example `notexample.com` for `*.example.com`) read authenticated responses cross-origin. Fixed in v2.52.3; upgrade to the latest v2 release.

### Other versions

All v2 releases before v2.52.16 also accepted origins with empty labels (`https://.example.com`, `https://a..example.com`), and v2.52.3 to v2.52.15 mis-parsed a wildcard entry after a comma and a space (`"https://a.com, https://*.example.com"`). No registrable domain produces such an origin, so these are hardening rather than part of this advisory. They are fixed in v2.52.16 (#4792).

## Affected packages

- `github.com/gofiber/fiber/v2 >= 2.52.1, < 2.52.3`

## Remediation

Upgrade to a patched release:

- `github.com/gofiber/fiber/v2 2.52.3`